Win32 32位进程加载64位kernel32.dll

Question

I am experiencing that 32-bit Win32 console applications are loading the 64-bit version of kernel32.dll on one specific machine which is running Windows Server 2012 R2 Standard.

Using Dependency Walker with a simple HelloWorld application it looks like this:

It correctly loads the 32-bit kernel32 on other machines.

The value of PATH seems to be if not identical so at least including the relevant paths in exactly the same order on the different machines.

According to this page from Microsoft, the search order for DLLs is:

1. The directory where the executable module for the current process is located.
2. The current directory.
3. The Windows system directory. The GetSystemDirectory function retrieves the path of this directory.
4. The Windows directory. The GetWindowsDirectory function retrieves the path of this directory.
5. The directories listed in the PATH environment variable.

I am guessing that on this specific machine GetSystemDirectory returns the path to Windows/system32 instead of Windows/SysWOW64 or that the mapping from system32 to SysWOW64 for 32-bit processes are not working properly but these are only qualified guesses.

Any idea what is causing this behaviour?

Answer 1

Dependency Walker is reporting the dependencies incorrectly. Its static analysis sometimes gets confused between 32 and 64 bit modules. Typically this is when you run a 64 bit version of Dependency Walker against a 32 bit target executable, or vice versa.

Rest assured that your 32 bit program is loading the 32 bit version of kernel32.